What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Have I Been Pwned (HIBP) lists a February 2026 CarGurus breach attributed to ShinyHunters, with 12.5 million affected email addresses. HIBP says the data was published after attempted extortion and included more than 12 million email addresses across multiple files. CarGurus later said its investigation found a limited, contained incident involving an internal database. Those are separate accounts: the breach-record details come from HIBP, while the later description of impact is CarGurus’ own characterization.
What was reported in the CarGurus breach?
HIBP’s breach record attributes the February 2026 incident to ShinyHunters and says data was published publicly following attempted extortion. HIBP describes more than 12 million email addresses across multiple files and lists 12.5 million affected addresses in its breach overview, added February 22, 2026.
As an Amazon Associate I earn from qualifying purchases.
The title figure of 12.4 million and HIBP’s 12.5 million figure are not reconciled by the available sources. TechCrunch reported on February 24, 2026 that CarGurus confirmed a cybersecurity incident; it reported HIBP’s 12.5 million figure and said CarGurus did not dispute it at that time. CarGurus spokesperson Maggie Meluzio told TechCrunch the incident had been contained.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhat information did HIBP list?
HIBP’s record describes files containing several kinds of information, not just a list of email addresses:
#1 Best Overall
- Names, phone numbers, physical addresses, and IP addresses.
- User account ID mappings.
- Finance pre-qualification application data, including auto finance application outcomes.
- Dealer account and subscription information.
This is HIBP’s description of the reported breach data. The available sources do not provide a complete record-by-record inventory or independently establish that the publicly released archive is complete.
What did CarGurus’ later investigation say?
In a dealer-facing update dated May 1, 2026, CarGurus said it had completed its investigation with help from an independent cybersecurity firm. The company characterized the incident as limited in scope and contained, involving an internal company database that was promptly secured.
CarGurus said dealer passwords were not compromised. It also said dealer data feeds, APIs, dealer CRMs, core systems, and products used by dealer partners or consumers were not compromised. The company described cases involving potentially sensitive dealership information as rare and said it contacted those partners directly. These are CarGurus’ findings and statements; they should not be read as a guarantee about every individual’s data or as a full inventory of the broader dump.
Was any of my account data exposed?
The reported categories mean some contact details and finance application information were included in the data HIBP describes, but the sources do not establish which specific individuals’ records were affected. CarGurus’ dealer-focused update does not identify every person in the published files. If you have a CarGurus account, check it for unusual activity and treat unexpected messages about the incident cautiously.
What should you do now?
Be alert for phishing
CarGurus recommends caution with unsolicited or suspicious emails and attachments, and regular training to recognize email and voice phishing. A message claiming you were affected could be an opportunistic scam. Do not reply, click links, open attachments, or send payment in response to a suspicious message.
Change reused passwords
HIBP recommends changing the breached password anywhere else you reused it. Use a unique password for each account, especially email and financial accounts that could help someone access other services.
Turn on multi-factor authentication
Enable multi-factor authentication (MFA), also called two-factor authentication (2FA), wherever supported. A hardware security key is one optional physical way to use MFA if the account supports it; the available sources do not verify security-key compatibility with CarGurus accounts, and no key is required because of this incident.
Do dealer partners need to rotate credentials or reissue API keys?
CarGurus said dealer passwords were not compromised and that dealer data feeds, APIs, and dealer CRMs were not compromised. Its May 1 update does not recommend rotating credentials or reissuing API keys as an incident response. Partners with questions about their own systems or potentially sensitive dealership information should use CarGurus’ direct communications rather than assume every case is identical.
What remains unknown?
The available sources do not explain how the attackers initially gained access, resolve the difference between 12.4 million and 12.5 million, or independently confirm the completeness of the published files. HIBP’s attribution and data categories should therefore be distinguished from CarGurus’ later investigation findings; neither source establishes a detailed access timeline in the material cited here.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
